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DETAILED ACTION 

1 . This application has been examined. Amendment received on 07/12/2004 has 
been entered. Claims 1,14, 25, 36, 43, 49, 60, 78 and 84 are currently amended. 
Claims 2-13, 15-24, 26-35, 37-42, 44^8, 50-59, 61-77, 79-83 and 85-87 are original. 

2. Claims 1-87 are presented for examination. 

Priority 

3. No priority claims have been made. 

4. The effective filing date for the subject matter defined in the pending claims in 
this application is 1 0/25/2000. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 1-87 rejected under 35 U.S.C. 103(a) as being unpatentable over Ennis, 
Jr. et al. (Patent Number 5,867,483), hereinafter referred to as Ennis, in view of Tarns et 
al. (U.S. Patent Number 6,327,620), hereinafter referred to as Tarns, and further in view 
of Schaffer (U.S. Patent Number 6,219,050). 

7. Regarding claim 1 , Ennis disclosed a method of monitoring a packet-switched 

network using traffic logs (Abstract, Figures 1 and 1 1 ), comprising: 

creating a histogram file (Figures 13-16, column 4 lines 45-64, column 5 lines 13- 
. 22); 



Application/Control Number: 09/695,402 Page 3 

Art Unit: 2144 

generating a traffic log at a first location within the network, the traffic log 
containing a plurality of values detected from data transmission (column 2 lines 
16-30, column 7 lines 22-28, column 8 lines 11-16); 

transferring the traffic log from the first location [short term database] to a second 
location [long term database] (Figure 10, column 14 lines 8-33); 

storing the traffic log generated by the network at the second location [long term 
database] (Figure 10, column 2 lines 16-30); 

analyzing the stored traffic log to determine the time of creation of the traffic log 
and the network entry and exit points of the packet (Figures 11, 1 3-1 6, column 3 
lines 58-67, column 4 lines 45-64). 

8. Ennis taught the invention substantially as claimed. However, Ennis did not 
specifically teach updating the histogram file using at least the time of creation of the 
traffic log and at least one of the entry and exit points of the packet. 

9. Ennis suggested exploration of art and/or provided a reason to modify the 
method with the updating feature (column 3 lines 58-64, column 4 lines 45-54). 

10. Tarns disclosed a method of monitoring a packet-switched network using traffic 
logs comprising the step of updating the histogram file using at least the time of creation 
of the traffic log and at least one of the entry and exit points of the packet (Figures 8 and 

10. column 35-65). 

11. It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the method of Ennis with the teachings of Tarns to 
include the updating feature in order to appropriately capture data transmission system 
activity (Ennis, column 9 lines 11-15) since network traffic monitoring generally being 
done over the specified time interval (Tarns, column 3 lines 44-45). 

12. The combination of Ennis and Tarns taught the invention substantially as 
claimed, however, the combination of Ennis and Tarns did not teach the step of 
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generating a traffic log at a first location within the network based upon detection of a 
packet, the traffic log containing a plurality of values detected from the packet including 
a network entry point and a network exit point of the packet. 

13. Tarns suggested exploration of art and/or provided a reason to modify the 
method of Tarns with generating a traffic log where each traffic log contains values such 
as network entry point and a network exit point of the packet for an individual packet 
(column 5 lines 1-9, column 13 lines 35-42, Table 2). 

14. Schaffer taught a method of generating a traffic log at a first location within the 
network based upon detection of a packet, the traffic log containing a plurality of values 
detected from the packet including a network entry point and a network exit point of the 
packet (Schaffer, Abstract, column 1 lines 17-35, column 2 lines 24-31, column 6 lines 
5-27); 

1 5. It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the combined method of Ennis and Tarns with the 
teachings of Schaffer to include a step of generating a traffic log where each traffic log 
contains values such as network entry point and a network exit point of the packet for 
an individual packet since for cases where an application's network behavior must be 
understood, the ability of capture and display data associated with an individual packet 
is desired because in multi-tier applications, it is often difficult to understand the source 
and destination of a packet (column 1 lines 54-64, column 2 lines 10-17). 

16. As the rejection reads, the combination of Ennis, Tarns, and Schaffer taught all 
the limitations as claimed in claim 1. 
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17. Regarding claim 2, Tarns disclosed a method wherein the histogram file is a flat 
file, whereby direct and rapid access to stored data is effected (column 2 lines 16-30). 

18. Regarding claim 3, Ennis disclosed a method wherein two histogram files are 
created, a first histogram being representative of traffic being passed into the network 
and a second histogram being representative of the traffic being passed from the 
network (column 4 lines 45-59, column 7 lines 23-52). 

19. Regarding claim 4, Ennis disclosed a method wherein the histogram file is 
representative of traffic passing to a host connected to the entry or exit point (Figure 1, 
column 7 lines 18-40). 

20. Regarding claim 5, Ennis disclosed a method further comprising repeating steps 
(b) - (d) for at least a predetermined period (column 4 lines 45-64, column 15 lines 31- 
45). 

21 . Regarding claim 6, Tarns and Schaffer disclosed a method further comprising 
analyzing the traffic log to determine state information of a packet associated with the 
traffic log, and updating the histogram with the state information (Tarns, column 7 lines 

> 

22-41; Schaffer, Abstract, column 3 lines 23-29). 

22. Regarding claim 7, Ennis and Tarns combined disclose a method wherein the 
histogram plots packets per minute versus time (Ennis, Figures 11 and 13-16; Tarns, 
column 3 lines 44-52). 

23. Regarding claim 8, Ennis disclosed a method further comprising broadcasting 
from a server computer data representative of the histogram to a client computer 
(column 15 lines 31-45). Tarns also disclosed this limitation (column 6 lines 39-45). 
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24. Regarding claim 9, Ennis disclosed a method wherein the network is a packet 
network [Mobitex network] (Title, Abstract). (Note: Mobitex technology is a well-known 
packet data network). 

25. Regarding claim 10, Ennis disclosed a method further comprising displaying a 
histogram based on data in the histogram file (Figures 1 1 and 13-16, column 6 lines 9- 
37, column 17 lines 6-24). 

26. Regarding claim 1 1 , Ennis and Tarns disclosed a method further comprising 
creating at least one histogram for each host of the network (Ennis, Figures 1 1 and 13- 
16, column 17 lines 25-53; Tarns, Tables 1-2). 

27. Regarding claim 12, Ennis disclosed a method further comprising selecting for 
display the at least one histogram for a particular host (Figures 1 1 and 13-16, column 
17 lines 24-53). 

28. Regarding claim 13, Tarns disclosed a method further comprising monitoring a 
central location of the network for new traffic logs (Figures 5-6 and 8, column 1 3 lines 
19-42). 

29. Regarding claim 14, Ennis, Tarns, and Schaffer combined disclose a method of 
monitoring packet traffic through a node of a packet-switched network using traffic logs, 
comprising: 

(a) creating a histogram file for at least one node in the network (Ennis, Figures 
13-16, column 4 lines 45-64, column 5 lines 13-22); 

(b) generating a traffic log at a first location within the network based upon 
detection of a packet, the traffic log containing a plurality of values detected from 
the packet including a network entry point and a network exit point of the packet 
(Schaffer, Abstract, column 1 lines 17-35, column 2 lines 24-31, column 6 lines 5- 
27); 
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(c) transferring the traffic log from the first location [short term database] to a 
second location [long term database] (Ennis, Figure 10, column 14 lines 8-33); 

(d) storing the traffic log generated by the network at the second location [long 
term databases] (Ennis, Figure 10, column 2 lines 16-30); 

(c) analyzing the stored traffic log to determine the time of creation of the traffic 
log and the network entry and exit points of the packet (Ennis, Figures 11, 13-16, 
column 3 lines 58-67, column 4 lines 45-64); 

(f) determining a network path between the entry and exit points of the packet 
(Ennis, Figures 11, 13-16, column 3 lines 58-67, column 4 lines 45-64, column 7 
lines 43-52); 

(g) determining whether the node falls along the network path (Ennis column 7 
lines 43-52); and 

(h) updating the histogram file using at least the time of creation of the traffic log 
when the node falls along the network path (Tarns, Figures 8 and 10, column 25 
lines 50-65; Ennis column 7 lines 43-52, column 8 lines 11-15). 

30. Regarding claim 15, Tarns disclosed a method wherein the histogram file is a flat 
file (column 2 lines 16-30). 

31 . Regarding claim 16, Ennis disclosed a method wherein two histogram files are 
created, a first histogram being representative of traffic being passed towards a higher 
level of the network and a second histogram being representative of the traffic being 
passed towards a lower level of the network or outside the network (column 4 lines 45- 
59, column 7 lines 23-52). 

32. Regarding claim 17, Ennis disclosed a method further comprising repeating steps 
(b) - (f) for at least a 24-hour period (column 4 lines 45-64, column 15 lines 31-45). 

33. Regarding claim 18, Ennis and Tarns combined disclose a method wherein the 
histogram plots packets per minute versus time (Ennis, Figures 11 and 13-16; Tarns, 
column 3 lines 44-52). 
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34. Regarding claim 19, Ennis disclosed further comprising broadcasting, from a 
server computer, data representative of the histogram to a client computer (column 15 
lines 31-45). Tarns also disclosed this limitation (column 6 lines 39-45). 

35. Regarding claim 20, Ennis disclosed wherein the network is a packet network 
[Mobitex network] (Title, Abstract). (Note: Mobitex technology is a well-known packet 
data network). 

36. Regarding claim 21 , Ennis disclosed further comprising displaying a histogram 
based on data in the histogram file (Figures 11 and 13-16, column 6 lines 9-37, column 
17 lines 6-24). 

37. Regarding claim 22, Ennis and Tarns disclosed further comprising creating at 
least one histogram for each node of the network (Ennis, Figures 1 1 and 13-16, column 
17 lines 25-53; Tarns, Tables 1-4A). 

38. Regarding claim 23, Ennis disclosed further comprising selecting for display the 
at least one histogram for a particular node (Figures 1 1 and 13-16, column 17 lines 24- 
53). 

39. Regarding claim 24, Tarns disclosed further comprising monitoring a central 
location of the network for new traffic logs (Figures 5-6 and 8, column 1 3 lines 19-42). 

40. Regarding claim 25, Ennis, Tarns, and Schaffer combined disclose a method of 
monitoring packet traffic through a link connecting two nodes of a packet-switched 
network using traffic logs, comprising: 

(a) creating a histogram file for at least one link in the network (Ennis, Figures 
13-16, column 4 lines 45-64, column 5 lines 13-22); 

(b) generating a traffic log at a first location within the network based upon 
detection of a packet, the traffic log containing a plurality of values detected from 
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the packet including a network entry point and a network exit point of the packet 
and a number of bytes of the packet (Schaffer, Abstract, Figure 1 , column 1 lines 
1 7-35, column 2 lines 24-31 , column 6 lines 5-27); 

(c) transferring the traffic log from the first location [short term database] to a 
second location [long term database] (Ennis, Figure 10, column 14 lines 8-33); 

(d) storing the traffic log generated by the network (Ennis, Figure 10, column 2 
lines 16-30); 

(c) analyzing the traffic log to determine the time of creation of the traffic log and 
the network entry and exit points of the packet(Ennis, Figures 11, 13-16, column 
3 lines 58-67, column 4 lines 45-64); 

(f) determining a network path between the entry and exit points (Ennis, Figures 
11, 13-16, column 3 lines 58-67, column 4 lines 45-64, column 7 lines 43-52); 

(g) determining whether the link falls along the network path (Ennis column 7 
lines 43-52); 

(h) determining a number of bytes carried by the packet associated with the 
traffic log (Shaffer, Figure 1, column 48-54); and 

(i) updating the histogram file using at least the time of creation of the traffic log 
when the node falls along the network path and the number of bytes when the 
link falls along the network path (Tarns, Figures 8 and 10, column 25 lines 50-65; 
Ennis column 7 lines 43-52, column 8 lines 11-15). 

41 . Regarding claims 26-35, the limitations are closely similar to the limitations of 
claims 1 5-24, and thus are rejected using the same rationale. 

42. Regarding claim 36, Ennis, Tarns, and Shaffer combined disclose a method of 
monitoring the operations of a packet-switched network, the network automatically 
generating a traffic log when a packet enters or exits the network by detecting values 
from the packet (Tarns, column 13 lines 35-38; Schaffer, Abstract), the method 
comprising: 

(a) detecting when a new traffic log is available at a network control center 
(Ennis, column 3 lines 41-67; Tarns, Figures 5 and 8); 
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(b) downloading the new traffic log to a server computer that maintains a plurality 
of histogram files (Schaffer, Figure 8 sign 114, column 8 lines 43-60); 

(c) updating at least one histogram file of the server computer using information 
available from the new traffic log by analyzing the new traffic log to determine 
one or more values detected from the packet that are stored by the new traffic 
log that are relevant to the at least one histogram (Ennis, Figures 8 and 10, 
column 35-65; Schaffer, column 8 lines 43-60); 

(d) deleting the new traffic log (Tarns, column 4 lines 29-43, column 25 lines 35- 
49); and 

(e) making the updated at least one histogram file available to a client computer 
from the server computer (Ennis, column 15 lines 31-45; Schaffer, column 8 lines 
61-67). 

43. Regarding claims 37-41 , the limitations are closely similar to the limitations of 
claims 2-13 & 15-24, thus these claims are rejected using the same rationale. 

44. Regarding claim 42, Tarns disclosed a method wherein the updating step 
comprises incrementing a value in the histogram file (column 2 lines 42-59). 

45. Regarding claim 43, Ennis, Tarns, and Schaffer combined disclose a method of 
analyzing the performance of a packet-switched network, the network automatically 
generating a traffic log, each time a packet exits the network, each traffic log including 
at least the time the traffic log was created, the addresses of the packet sender and 
packet recipient, and the entry and exit network nodes (Schaffer, Abstract, Figure 1 , 
column 1 lines 13-35, Tarns, Figure 5, column 4 lines 17-24) the method comprising the 
steps of: 

(a) collecting at a centralized location a plurality of traffic logs from the network, 
with each traffic log containing information relevant to a different packet that has 
exited the network (Ennis, Abstract, column 3 lines 41-67, column 4 lines 45-67; 
Tarns, Table 2); 
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(b) analyzing each of the plurality of traffic logs to determine information about 
each of the packets that have exited the network (Schaffer, column 1 lines 17-35, 
column 6 lines 5-26); 

(c) automatically generating a plurality of histograms, each histogram being 
based on information gleaned from the plurality of traffic logs about the packets 
that have exited the network, wherein at least one histogram is representative of 
packet traffic passing through a host connected to the network (Ennis, Figures 1 1 
and 13-16, column 4 lines 45-67, column 14 lines 1-33). 

46. Regarding claims 44-48, the limitations are closely similar to the limitations of 
claims 2-3, 8, 12, and 33. 

47. Regarding claims 49-59, the system corresponds directly to the method of claims 
1-13, and thus these claims are rejected using the same rationale. 

48. Regarding claims 60-68, the system corresponds directly to the method of claims 
14-16 & 18-23, and thus these claims are rejected using the same rationale. 

49. Regarding claims 69-77, the system corresponds directly to the method of claims 
25-27 & 29-34, and thus these claims are rejected using the same rationale. 

50. Regarding claims 78-83, the system corresponds directly to the method of claims 
36-41 , and thus these claims are rejected using the same rationale. 

51 . Regarding claims 84-87, the system corresponds directly to the method of claims 
43 & 46-47, and thus these claims are rejected using the same rationale. 

52. Since all the limitations of the claimed invention were disclosed by the 
combination of Ennis, Tarns, and Schaffer, claims 1-87 are rejected. 

Response to Arguments 

53. Applicant's arguments received on 07/12/2004 with respect to claims 1-87 have 
been considered but are moot in view of the new ground(s) of rejection. 
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54. In response to applicants' response that Ennis and Tarns do not disclosed traffic 
logs where each traffic log contains values for a particular packet it is submitted that 
Schaffer disclosed a network protocol analyzer that generates a traffic log for each 
individual packet based upon detection of a packet. Similar to Ennis teachings, Schaffer 
disclosed the step of forwarding the traffic log from the first location to the second 
location for analysis. In addition, Schaffer also disclosed other limitations, which are 
relevant to the claimed invention. Refer to the above rejection for complete details. 
Examiner asserts that the combined teachings of Ennis, Tarns, and Schaffer disclosed 
all the claimed limitations of the currently amended claims. 

55. In response to Applicants' analysis/explanation of the amended claiml "Once at 
the second location, knowledge independent of the traffic log is not necessary to 
determine the path of the packet since this information can be determined from the 
values of the traffic log," the Examiner would like to remind applicants that although the 
claims are interpreted in light of the specification, limitations from the specification are 
not read into the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 USPQ2d 1057 (Fed. 
Cir. 1993). 

56. In response to applicants' response "Ennis and Tarns do not provide any data 
relevant to an individual packet, including the state of each packet," it is submitted that 
Schaffer disclosed a protocol analyzer that capture the behavior of individual packets 
(column 3 lines 24-29) as detailed in the above rejection. 

57. As the rejection reads, Examiner asserts that the combination of these teachings 
render the claimed invention obvious. 
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Conclusion 

58. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

59. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Tarn (Jenny) Phan whose telephone number is (571) 
272-3930. The examiner can normally be reached on M-F 9:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William Cuchlinski can be reached on (571) 272-3925. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 
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Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 




William Cuchlinski 
SPE 

Art Unit 2144 
(571)272-3925 
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October 29, 2004 



